CVE-2026-23884
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In FreeRDP prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing a use-after-free (UAF) when related update packets arrive. A malicious server can trigger this client-side vulnerability, causing a crash (DoS) and potential heap corruption with code-execution risk.
Risk Assessment
The organization is exposed to DoS attacks and potential remote code execution on RDP clients by a malicious server, which could lead to data breaches or further lateral movement within the internal network.
Recommendation
Immediately upgrade FreeRDP to version 3.21.0 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A malicious server can trigger a client‑side use after free, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.